Beginner Guide to ROM Save State Hacking

Have you ever want to do a quick run through old game for nostalgia or maybe just have fun tweaking things to make the game different? If so, this is the thread for you! If you love old school video game emulation then you might really enjoy this. It’s fairly simple once you get the hang of it.

Things you’ll need:

  • An emulator (software that acts as a gaming console on your computer)
  • ROM (game file for the emulator)
  • Hex editor with a compare feature (This reads code in its raw hexadecimal equivalent, which is not generally human readable, but allows you to directly manipulate the code). Hex Workshop is a good one.

We’ll use a very simple example to explain how it works. This is, in effect, a type of reverse engineering so sometimes it may come down to trial an error, but there are things you can do to narrow your search once you get the basics down!

For this example, we’ll use the Super Mario Bros ROM with the NESticle emulator to hack the amount of lives Mario has.

1. Begin the game and make a save state. This should create a file along the lines of super_mario_bros.st0 in your NESticle folder somewhere. Now run into that first goomba kamikaze style and die. As they say in Soviet Russia, you hef to break a few Marios to make a hack.

2. Respawn! Change the save slot to slot 1 and save again. You now have two save state files ending in .st0 and .st1 corresponding to the save slots respectively.

3. Open these save state files in your hex editor. Use the “compare” tool and it while highlight any differences between the code in .st0 and .st1, which shouldn’t be too much because both save states were made at a similar point in the game.

-TIME OUT-
What do we know so far? We know that .st0 has 3 lives and .st1 has 2 lives. We also know that the time on clock may be different and the animation on the coin icon may be set to a different frame, so there is likely going to be some differences in the code besides the amount of lives. We need to narrow it down to the code that sets the amount of lives. With this knowledge, we have two methods to go about doing this.

Method A
This a sort of brute force method of hacking a state. It can be slow going, but it is definitely necessary to know how to do this.

A1. Having compared the two state files, you can simply start with the first difference in code. Copy the hexcode from offset (hex address) of .st0 to the same offset in .st1, save .st1 and then load save slot 1 in Super Mario Bros.

A2. Look at Mario’s lives? Does it say 3 lives or is it still 2? If Mario still have only 2 lives, repeat the process in step 1 until you have 3 lives. Once it changes to 3 lives, you now know which offset you need to edit to change the amount of live Mario has. Want to have 99 lives? All you have to do is enter the hex value for 99, “63″, into the appropriate offset. You should be able to do this to any save state at any point in the game now.

Method B
While the previous method works quite well, we happen to know the value we want to search for so we can save ourselves a lot of time. This is why hacking number values is usually one of the easiest to accomplish. We will continue from where we left off comparing files in step 3 above.

B1. Convert the decimal 3 to the hex value for 3. Use a hex calculator. Oh what’ya know? 3 is still 3 in hexadecimal, but remember that it is probably going to be written as “03″ in the state file.

B2. Find the value “03″ within the hex code of st0. It should be in one of the areas already highlighted as different. Once you find it, check the same offset in st1 and it should be set to “02″. If so, you probably have the right one and you can try tweaking the code to see if it changes the amount of lives. If not, just find the next instance of “03″ in st0. This is much quicker than checking every difference in code as it really narrows down your search.
That’s it! You are now save state h4x0r! Lvl up!

There is a great joy that comes with reaching into the raw code of a game and bending it to your will. Have fun!

Homework: Try to find the offset which controls whether Mario is big, small, flower powered or star powered!

If you have some experience and want some insight into some more advanced tricks, see this post on how I discovered my trophy “No Random Encounters” code for Phantasy Star II!

Tags: , , , , , , , , , , , , , , ,

One Response to “Beginner Guide to ROM Save State Hacking”

  1. sh7dow says:

    Another quality post from the Green Pirates Crew.

Leave a Reply